makefu/stockholm
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

tv iptables: move sshd stuff to sshd config

Browse source
This commit is contained in:
tv 2020-10-17 01:00:54 +02:00
parent 4d5c1b6dbe
commit b034f63f7a
2 changed files with 17 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
tv/2configs/sshd.nix
View file

@ -1,10 +1,22 @@
{ config, lib, pkgs, ... }:
with import <stockholm/lib>; with import <stockholm/lib>;
{ config, ... }: let
{ cfg.host = config.krebs.build.host;
in {
services.openssh = { services.openssh = {
enable = true; enable = true;
}; };
tv.iptables.input-internet-accept-tcp = singleton "ssh"; tv.iptables.input-internet-accept-tcp = singleton "ssh";
tv.iptables.extra.nat.OUTPUT = [
"-o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22"
];
tv.iptables.extra4.nat.PREROUTING = [
"-d ${cfg.host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT"
];
tv.iptables.extra6.nat.PREROUTING = [
"-d ${cfg.host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT"
];
tv.iptables.extra.nat.PREROUTING = [
"-p tcp --dport 22 -j REDIRECT --to-ports 0"
"-p tcp --dport 11423 -j REDIRECT --to-ports 22"
];
} }

9
tv/3modules/iptables.nix
View file

@ -135,15 +135,8 @@ let {
:INPUT ACCEPT [0:0] :INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0]
${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") [
"! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0"
"-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
]}
${concatMapStringsSep "\n" (rule: "-A OUTPUT ${rule}") [
"-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
]}
${formatTable cfg.extra.nat}
${formatTable cfg."extra${toString iptables-version}".nat} ${formatTable cfg."extra${toString iptables-version}".nat}
${formatTable cfg.extra.nat}
COMMIT COMMIT
*filter *filter
:INPUT DROP [0:0] :INPUT DROP [0:0]